Nextcloud earns ANSSI CSPN and BSI IT-Grundschutz certifications

Hub 26 Summer launches live!

Join us for the livestream and be among the first to discover
what’s new in Nextcloud.

September 16 @ 3 PM CEST / 9 AM EDT

Watch live on YouTube or PeerTube

Set a reminder

For public sector organizations and regulated industries, compliance isn’t optional. Nextcloud recently earned two European security certifications and a reference Data Protection Impact Assessment (DPIA). Together, they simplify compliance for enterprise customers.

Nextcloud Files achieves French CSPN certificate

France’s cybersecurity authority ANSSI (Agence nationale de la sécurité des systèmes d’information) awarded Nextcloud the CSPN certification (Certification de Sécurité de Premier Niveau).

CSPN is a first-level security certification and a standard reference point in French public tenders, comparable to how BSI-approved products work in Germany. ANSSI ran Nextcloud Files through vulnerability and penetration tests. No issues were reported, a positive signal for all Nextcloud customers.

If you’re rolling out Nextcloud in a French public sector context, CSPN removes a procurement hurdle you’d otherwise have to clear product by product. But even outside France, this certification holds weight, as it means that an independent government agency tested the software for vulnerabilities and found none.

BSI IT-Grundschutz via Dataport

Certifications like SOC 2 or BSI C5 check operations, not software. They look at how a provider manages and hosts software, not the software itself. That’s usually why you see these certifications sitting with Nextcloud’s partners, not with Nextcloud.

Recently, public sector IT service provider Dataport made available a Nextcloud service that is operated within a German Federal Office for Information Security (BSI) IT-Grundschutz-certified environment. While the Nextcloud instance itself is not directly part of the certification scope, its operation is embedded in Dataport’s ISMS and follows the strict security requirements of the BSI. This enables public sector organizations to benefit from a highly secure and compliant workspace, supporting their efforts towards digital sovereignty.

What this means for our customers in Europe

IT-Grundschutz stands for « IT baseline protection ». It’s broader than a pure IT checklist: it covers organization, staff, physical rooms, and documentation alongside technical controls. German federal authorities have to implement IT-Grundschutz, while state-level authorities often adopt it voluntarily. It’s not a legal requirement for private companies, but operators of critical infrastructure and organizations under NIS2 can use it as an accepted way to meet their security obligations. The standard behind this certification is one of the most thorough security frameworks in Europe, and it now covers a real, hosted Nextcloud deployment, not just a theoretical setup.

BSI officially recognizes CSPN as equivalent to its own Accelerated Security Certification (Beschleunigte Sicherheitszertifizierung, BSZ). Both map to the European standard EN 17640, which makes them compatible with the EU Cybersecurity Act (CSA).

BSI IT-Grundschutz builds on ISO 27001, the internationally recognized standard for information security management. That’s what gives it weight across Europe, not just in Germany.

Extensive DPIA gives Nextcloud Enterprise the green light

Earlier this month, the European privacy and compliance specialist Privacy Company published a DPIA on Nextcloud Enterprise. Commissioned by the Dutch higher education IT cooperative SURF the DPIA mapped how Nextcloud Enterprise handles data and identified possible risks.

The DPIA also comes with practical guidance for running Nextcloud in compliance-critical setups. That’s a strong start for other privacy-sensitive organizations that plan to assess Nextcloud’s GDPR compliance.

Zero access, by design

Certifications and audits tell you the software held up under defined testing. They don’t make the next attack impossible. What actually limits the damage when something does go wrong is that Nextcloud has no access to data on the servers of its customers. There’s nothing to breach on our end because there’s nothing here to take.

If you’re assessing Nextcloud Enterprise for your own organization, you can request a free trial or contact us for a quote tailored to your needs. We’ll talk through what a deployment would look like and which data residency and hosting configuration fits your needs.